PeopleSoft Enterprise FIN CVE-2026-60601

Exploitation requires the attacker to have local logon access to the infrastructure where PeopleSoft Enterprise FIN Common Objects 9.2 executes - this is not remotely exploitable. The attacker must hold at minimum low-privileged credentials on that host (PR:L). Critically, successful exploitation also requires human interaction from a person other than the attacker (UI:R), meaning a second user must perform some action within the PeopleSoft environment during or around the attack. High attack complexity (AC:H) indicates that specific timing, race conditions, or precise environmental configuration must align for the attack to succeed. What limits exploitation: remote network attackers are entirely excluded; the attacker population is restricted to insiders or users of already-compromised PeopleSoft application servers; the co-user interaction requirement introduces an element of social engineering or opportunistic timing; and high complexity means exploitation is not reliably repeatable without significant knowledge of the system internals.

The overall real-world risk is moderate-to-low despite the high integrity impact (I:H). The CVSS vector (AV:L/AC:H/PR:L/UI:R) imposes four compounding constraints: the attacker must already have local infrastructure access, exploitation complexity is high, low privileges are required (ruling out completely unauthenticated scenarios), and a separate human must interact. EPSS data was not provided, so exploitation probability cannot be quantified numerically. Neither CISA KEV listing nor public POC code has been identified, further reducing urgency. The 'Authentication Bypass' tag from the intelligence source elevates concern conceptually - a bypass of the Security component in a financial ERP is a sensitive class - but the local-only vector substantially limits the realistic attacker population to insiders or already-compromised hosts. This is not a remote exploitation scenario and should be prioritized behind internet-facing critical vulnerabilities, but warrants patching within a standard quarterly cycle given the financial data sensitivity of PeopleSoft FIN environments.

A malicious insider or attacker who has already gained local access to the PeopleSoft application server with a standard low-privileged OS or application account waits for a privileged user (such as an administrator or financial clerk) to perform a routine operation within PeopleSoft FIN. By exploiting the authentication bypass in the Security component at that moment, the attacker manipulates critical financial data records - such as vendor master entries or GL chart-of-accounts - without authorization. No public proof-of-concept code has been identified, and high attack complexity means reliable exploitation likely requires detailed knowledge of the PeopleSoft internals.